CVE-2023-6902 - codelyfe Stupid Simple CMS upload.php unrestricted upload

Back Back to CVE browser

CRITICAL

codelyfe Stupid Simple CMS upload.php unrestricted upload

Published Dec 17, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 0.97%

Description

A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical. This vulnerability affects unknown code of the file /file-manager/upload.php. The manipulation of the argument file leads to unrestricted upload. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248260.

Affected products

Vendor Codelyfe Product Stupid Simple CMS Default
n/a
- Version
  1.2.0
  Status
  affected
  Constraints
  -
- Version
  1.2.1
  Status
  affected
  Constraints
  -
- Version
  1.2.2
  Status
  affected
  Constraints
  -
- Version
  1.2.3
  Status
  affected
  Constraints
  -
- Version
  1.2.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Codelyfe

Stupid Simple CMS

n/a

Version	Status	Constraints
1.2.0	affected	-
1.2.1	affected	-
1.2.2	affected	-
1.2.3	affected	-
1.2.4	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (3)

https://github.com/g1an123/POC/blob/main/Unauthorized%20file%20upload%20getshell.md
exploitThird Party Advisory
https://vuldb.com/?ctiid.248260
signaturepermissions-requiredPermissions RequiredThird Party Advisory
https://vuldb.com/?id.248260
vdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://github.com/g1an123/POC/blob/main/Unauthorized%20file%20upload%20getshell.md		exploitThird Party Advisory
https://vuldb.com/?ctiid.248260		signaturepermissions-requiredPermissions RequiredThird Party Advisory
https://vuldb.com/?id.248260		vdb-entrytechnical-descriptionThird Party Advisory